Skip to content
Threat Feed
Subscribe

Product

Gitea/Gitea Docker Images

1 brief RSS
critical advisory

Gitea Docker Images Insecure Default Allows User Impersonation via X-WEBAUTH-USER

Gitea Docker images ship with a critical misconfiguration, CVE-2026-20896, where `REVERSE_PROXY_TRUSTED_PROXIES = *` by default, enabling any client to bypass authentication and impersonate users via the `X-WEBAUTH-USER` HTTP header when reverse proxy authentication is enabled, leading to unauthorized access to user accounts, including administrative ones.

PoC gitea/gitea Docker images +1 misconfiguration authentication-bypass docker gitea web-application cve
1r 2t 1c updated